BUG: Partly typed passwords works

Hello!
I and my clients noticed that - partly typed passwords works for /stats/ directory and for FTP access.
Example:
Orginal password: Lainite9449270
User can log in to ftp and /stats/ directory just typing username and password: Lainite9 can access to his account. this not works for ispconfig login.
I tried to do something with password: [email protected] but unsuccesofully. Somewhere is little bug what allows gain access, but i can't notice where and how to fix it.